Operations Manager (SCOM, OpsMgr) has the ability to monitor an untrusted domains as well as highly segmented\firewalled networks. 

Gateways can be within the trusted domain as well, but are highly segmented by Firewalled VLANs.  The Gateways that are installed in the trusted domain do not actually utilize certificates, as the untrusted domain computers do.  In this case, the trusted computers utilize Kerberos (SPNs must be registered) and they may also require a Trusted Internal CA Root Cert.

The untrusted Gateway cannot properly communicate to the MS’s (EVENT ID 220071, 21016)

OpsManager Unable to set up a communication channel with MS

I validate the following:

1. Verify Manual Agent Installs show in Pending Actions for approval
   • In the Operations Console, Administration>Settings>Security
     • Ensure ‘Review new manual agent installations in pending managmeent view’ is checked
2. Recycle the HealthService (System Center Management Service)
3. SPN’s registered for DB\DW and MS’s
   • Restart of Servers in this order may be necessary
     1. DB\DW Instances
     2. RMSe Management Server
     3. Other MS’s
4. Install GW as local Administrator
   • GW Approval tool run using an account with SysAdmin privileges to SQL DB
5. Certificates are OK
   • Trusted Root Certificates on All GW and MS
   • Ensure Full Name of Computer is used as the Friendly name and name of the certificate
   • OpsMgr Cert unique to each computer and imported
   • Using 1024 or 2048 key size (2048 adds slight CPU overhead)
     • MOMCertImport changes this to 1024
   • Expiration OK
     • MOMCertImport changes this to 1 year in the Registry
   • If you cannot request the certificate from the GW or Agent:
     • Use the web site on the MS to request a server cert
6. Gateway approval tool is OK
   • Ensure the following files exist on the Management Server:
     • Microsoft.EnterpriseManagement.GatewayApprovalTool.exe
     • Microsoft.EnterpriseManagement.GatewayApprovalTool.config
   • Command Run successfully:
     • Microsoft.EnterpriseManagement.gatewayApprovalTool.exe /ManagementServerName=<managementserverFQDN> /GatewayName=<GatewayFQDN> /Action=Create
7. Port 5723 has been validated as Open
   • I haven’t seen the need for 5724 in the past, although mentioned in the MS documentation
8. Telnet to 5723 to the MS succeeds
9. Check DNS
   • Mgmt Server name resolves to IP
   • Potential Hosts file edit or DNS entry
10. Try re-copying the certificate out of the OperationsManager Folder into the Trusted Root store and restarting HealthService
11. Flushing Health Service Cache
12. Reinstalling GW and pointing to different MS
13. Reissuing Certificates and reimporting, then running MOMCertImport
14. Recycle the HealthService (System Center Management Service)